Heroku 是否保护单个站点免受 DoS / DDoS 攻击？
Heroku 目前似乎正遭受 DDoS 攻击，这导致整个网站出现间歇性可用性问题，并在（当然！）我的应用程序上表现出来。
我最近看到了很多此类攻击，包括几个月前针对 Register.com 的大规模 DDoS 攻击。
我的问题是，如果攻击者瞄准 Heroku 的一位客户，会发生什么？
Heroku 是否保护单个应用程序免受 DoS 和 DDoS 攻击？
Heroku is, it seems, under a DDoS attack right now, which is causing intermittent availability issues across the site manifesting themselves on (of course!) my app.
I have seen a number of these kinds of attacks recently, including the huge DDoS attack on Register.com a few months ago.
My question is, what were to happen if attackers zero'ed in on one of Heroku's clients?
Does Heroku protect individual apps from DoS and DDoS attacks?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
简短回答：是的。 Heroku 的 dynos 受到保护，因为它们每个都有自己的文件系统和自己的用户等。
长答案：根据 (D)DoS 攻击的严重程度，可能存在一个点是来自 DoS 的请求负载攻击将需要比 Heroku 云可用的资源更多的资源。您可能会遇到请求延迟并且应用程序响应能力可能会降低。但重要的是要理解这种“缺乏性能”并不意味着违反了安全。 Heroku（来自我与员工进行的几次对话）有一个非常强大的路由层，有助于平衡负载并避免使用故障排除和/或无响应的测功机（应用程序的实例），但话又说回来，一个真正的分布式拒绝服务攻击及其对服务器造成的巨大负载最终可能会导致云中的资源根本不够用。
<推测>正是在这一点上，提供商（本例中为 Heroku）通常只能选择尝试隔离攻击，通常通过“坚守阵地”来完成（如果您愿意在 dns 级别）并且（暂时）拒绝对受到攻击的域的请求。并不是说这是唯一的方法，而是一种方法。非常取决于攻击的具体情况，当然作为局外人，我不知道。
参考：http://www.heroku.com/how /dynos
我不是 Heroku 的员工或代表，只是一个用户 - 与他们联系以了解更多细节
Short answer: Yes. Heroku's dynos are protected by the fact they each have their own file-system and their own user, etc.
Long answer: Depending on the severity of the (D)DoS attack, there can be a point were the load of requests from a DoS attack will require more resources than are available to heroku's cloud. You may experience delayed requests and application responsiveness may be reduced. It is important though to understand this 'lack of performance' does not indicate a breach of security . Heroku's, (iirc from a couple convos I've had with employees) has a pretty robust routing layer which helps to balance the load and avoid using troubleshome and/or unresponsive dynos (instances of your application), but then again, a truly Distributed Denial of Service attack, with it's ludicrous amount of load on the server may eventually hit a point where the resources in the cloud are simply not enough.
<speculating>It is at that point that the providers (Heroku in this case) usually only have the option of trying to isolate the attack, usually done by 'holding the line' if you will at the dns-level and (temporarily) rejecting requests to the domain/s under attack. Not to say this is the only way, but one way. Very dependent on the specifics of the attack, which of course as an outsiders, I don't know.
</speculating>ref: http://www.heroku.com/how/dynos
I am not an employee or representative of Heroku, just a user-- talk to them for more specifics
这个问题可能较旧，但在搜索结果中显示在较高位置。
Heroku 在其安全页面上声明：
来源：https://www.heroku.com/policy/security
测试 DDoS 时也很有趣加载：
来源：https://devcenter.heroku.com/articles/http-routing#request -排队
This question may be older but it's shown on a high position in search results.
Heroku states on their security page:
Source: https://www.heroku.com/policy/security
Also interesting when testing a DDoS load:
Source: https://devcenter.heroku.com/articles/http-routing#request-queueing